US10243733B2ActiveUtilityA1
Process and system for establishing a moving target connection for secure communications in client/server systems
Individually held — no corporate assignee on recordPriority: Mar 17, 2016Filed: Mar 16, 2017Granted: Mar 26, 2019
Est. expiryMar 17, 2036(~9.7 yrs left)· nominal 20-yr term from priority
H04L 9/3242H04L 9/16H04L 9/3066H04L 9/0841H04L 9/0869H04L 9/14
17
PatentIndex Score
0
Cited by
4
References
12
Claims
Abstract
A system and method performs a moving target blind rendezvous by exchanging data through a distributed hash table. The system allows users to securely send small pieces of information over a network while only requiring an exchange of public keys ahead of time. The system relies on the size and resilience of the BitTorrent Distributed Hash Table and the security properties of cryptographic constructions such as Elliptic Curve Diffie-Hellman key exchange and secure one-way hash functions.
Claims
exact text as granted — not AI-modifiedThe invention claimed is:
1. A secure communication network, comprising:
at least one server connected to the network and accessing a Distributed Hash Table (DHT), the server having a private and public cryptographic key pair (S pri , S pub );
a plurality of clients connected to the network and in communication with the server, each client having a unique private and public cryptographic key pair (C pri , C pub );
the server and a communicating client implementing a randomly generated key that changes at some predetermined interval, the server publishing a descriptor d T calculated using the server's private key S pri and the client's public key C pub and storing the descriptor d T in the DHT, and the client querying for the descriptor d T stored in the DHT to obtain configuration information;
wherein when the server publishes to the DHT, the server generates a descriptor for time period T, d T , and a message m, where d T is calculated by the server using the following equation: d T =H(S pri ·C pub i )∥T) 0→159
where H is a strong hashing algorithm, S pri is the server's private key, C pub i is the public key for client C i , and T defines the time period, and the message, m, is calculated by using the following equation:
m
=
Nonce
||
MAC
||
E
C
pub
i
(
E
S
pri
i
(
SeedIPv
6
S
||
K
||
Rot
)
)
where SeedIPv6 S is an Internet Protocol version 6 (IPv6) address which is the concatenation of the server's IPv6 subnet and a randomly generated seed Interface Identifier (IID), K is a symmetric key, Rot is an address rotation period, and Nonce and MAC are generated by encryption algorithms; and
wherein the time period, T, is used as a component within the DHT descriptor and is varied in duration to provide the capability to dynamically and securely exchange configuration information depending on a detected environment.
2. The secure communication network of claim 1 , wherein the server stores arbitrary piece of data in the DHT that is retrieved by a client, the server generates a DHT key or descriptor d T and calculates a shared secret using a function over the private key S pri of the server and the public key C pub of the client, and when a client requests data from the DHT, the client generates d T by concatenating the shared secret between the client and the server generated using a function over the client's private key C pri and the server's public key S pub .
3. The secure communications network of claim 1 , wherein a client's seed Interface Identifier (IID) is generated as shown in the following equation:
C IID =H (( S pri ·C pub )∥ K ) 0→63 =H (( S pub ·C pri )∥ K ) 0→63
where H is a strong hashing function and K is a key that has been pseudo-randomly generated by the server and was retrieved by the client from the DHT, the retrieved message containing all of the configuration information required to calculate the client's own addresses, namely the key (K), the rotation period (Rot), and a server's seed IID, and the client calculates its own seed IID with the server's public key and its own private key.
4. The secure communication network of claim 1 , wherein the server generates a different message for each client, even if each client should receive the same unencrypted message, due to the fact that the server uses the client's public key in order to encrypt an original message.
5. The secure communication network of claim 1 , wherein the DHT is the BitTorrent Distributed Hash Table.
6. The secure communication network of claim 1 , wherein the encryption algorithm used is the Elliptic Curve Diffie-Hellman (ECDH) algorithm.
7. A method of providing secure communication over a network, comprising the steps of:
connecting at least one server to the network, the server accessing a Distributed Hash Table (DHT) and having a private and public cryptographic key pair (S pri , S pub );
connecting a plurality of clients to the network so as to be in communication with the server, each client having a unique private and public cryptographic key pair (C pri , C pub );
implementing by the server and a communicating client a randomly generated key that changes at some predetermined interval;
publishing by the server a descriptor d T calculated using the server's private key S pri and the client's public key C pub ;
storing by the server the descriptor d T in the DHT, and
querying by the client for the descriptor d T stored in the DHT to obtain configuration information;
the step of publishing by the server to the DHT, the step of publishing including the steps of:
generating by the server a descriptor for time period T, d T , and a message m, where d T is calculated by the server using the following equation:
d T =H ( S pri ·C pub i )∥ T ) 0→159
where H is a strong hashing algorithm, S pri is the server's private key, C pub i is the public key for client C i , and T defines the time period, and
generating by the server the message, m, is calculated by calculating equation:
m
=
Nonce
||
MAC
||
E
C
pub
i
(
E
S
pri
i
(
E
Nonce
(
SeedIPv6
S
||
K
||
Rot
)
)
)
where SeedIPv6 S is an Internet Protocol version 6 (IPv6) address which is the concatenation of the server's IPv6 subnet and a randomly generated seed Interface Identifier (IID), K is a symmetric key, Rot is an address rotation period, and Nonce and MAC are generated by encryption algorithms; and
wherein the time period, T, is used as a component within the DHT descriptor and is varied in duration to provide the capability to dynamically and securely exchange configuration information depending on a detected risk environment.
8. The method of providing secure communication over a network of claim 7 further comprising the steps of:
storing by the server stores arbitrary piece of data in the DHT that is then retrieved by a client;
generating by the server a DHT key or descriptor d T ;
calculating by the server a shared secret using a function over the private key S pri of the server and the public key C pub of the client; and
when a client requests data from the DHT, generating by the client d T by concatenating the shared secret between the client and the server generated using a function over the client's private key C pri and the server's public key S pub .
9. The method of providing secure communications over a network of claim 7 , further comprising the step of generating a client's seed Interface Identifier (IID) by calculating the following equation:
C IID =H (( S pri ·C pub )∥ K ) 0→63 =H (( S pub ·C pri )∥ K ) 0→63
where H is a strong hashing function and K is a key that has been pseudo-randomly generated by the server and was retrieved by the client from the DHT, the retrieved message containing all of the configuration information required to calculate the client's own addresses, namely the key (K), the rotation period (Rot), and a server's seed IID, and the client calculates its own seed IID with the server's public key and its own private key.
10. The method of providing secure communications over a network of claim 7 , further comprising the step of generating by the server a different message for each client, even if each client should receive the same unencrypted message, due to the fact that the server uses the client's public key in order to encrypt an original message.
11. The method of providing secure communications over a network of claim 7 , wherein the DHT is the BitTorrent Distributed Hash Table.
12. The method of providing secure communications over a network of claim 7 , wherein the encryption algorithm used is the Elliptic Curve Diffie-Hellman (ECDH) algorithm.Join the waitlist — get patent alerts
Track US10243733B2 — get alerts on status changes and closely related new filings.
We store only your email — no account needed. See our privacy policy.